Police raids lead to the arrest of 13 suspects in British taxpayer phishing scam

Romanian police have raided the homes of more than a dozen suspects on Thursday in connection with a targeted phishing scam that siphoned £47 million from British taxpayers.

Thursday’s arrests topped off a year-long joint investigation with Romanian prosecutors, the British HMRC tax authority, and the Crown Prosecution Service (CPS).

The thirteen suspects are accused of stealing the personal information of more than 100,000 Brits, and then illegally accessing at least 1,000 HMRC taxpayer accounts to claim tens of millions in fraudulent government payments, the Romanian Police’s Economic Crimes Investigation Directorate said.

Over 100 Romanian police officers were involved in the raids, which were recorded and uploaded to YouTube.

The suspects, all between the ages of 23 and 53, are thought to be high-ranking members of an organized crime group – making them part of a case, already underway by prosecutors involving an additional 254 low-level members of the same criminal group.

William Wright, CEO of Closed Door Security says tax scams are one of the biggest risks to citizens in the UK.

“Criminals are adopting tactics to make them highly convincing, often using a mix of emails, post and SMS to send out fraudulent comms,” he says says.

“The correspondence often looks genuine, and it takes a very savvy consumer to question its authenticity, especially as criminals often hijack on key tax dates, such as the self-assessment deadline in January,” Wright says.

The Politia Romana said they were able to seize a multitude of physical evidence during the raids, including luxury cars and large sums of cash.

The house searches took place in the capital city of Bucharest, as well as in the counties of Ilfov, Giurgiu, and Călărași, according to local media.

How the scam worked

Prosecutors say the unnamed group has been operating the fraudulent tax scheme since September 2023, which involved stealing the login credentials and other personal data of British taxpayers using sophisticated phishing attacks.

By gaining unauthorized access to UK "Government Gateway" accounts, the criminals were able to compromise “over 1,000 accounts held by British taxpayers.”

Once in the HMRC system, the evidence shows the criminals would either edit the taxpayer’s account details or create new fraudulent accounts using names and social security numbers of legitimate taxpayers.

To avoid detection, the criminals would also register fake employers in the UK Revenue Agency systems, and submit "PAYE" (Pay As You Earn) tax return applications.

The gangs would then use the phony accounts to submit false tax repayment claims, including on income tax, value-added tax, and child benefit payments, the British tax authority said.

The fraudulent payments were allegedly directly deposited into bank accounts opened up by the criminals at UK banks. From there, the funds would be transferred to other accounts or withdrawn in cash from an ATM, a form of money laundering, officials said.

Wright explains that phishing is often seen as "a low-level threat, because attacks are easy to execute and require no real computing skill; however, the attacks are rife and very successful."

Earlier this year, Wright notes that the HMRC also lost millions "after criminals seemingly tricked HMRC employees into executing fraudulent transactions... showing that the risk to consumers and employees of the tax office remains worryingly high."

"Almost every breach today has a human element, and it is vital the security industry and government work harder to thwart this threat," Wright says.

More arrests, victims notified

The Romanian Police’s Economic Crimes Investigation Directorate is charging the 13 suspects with computer fraud, money laundering, and illegal access to a computer system, the police said.

A 38-year-old man was additoinally arrested in northwest England on Thursday as part of the law enforcement effort, with electronic devices also being seized during that raid.

The HMRC further reported two other men in connection with the scam had been arrested for online fraud in Bucharest last November.

HMRC, or His Majesty's Revenue and Customs, is the UK’s tax, payments, and customs authority, collecting monies to support British public services

"We have already acted to protect customers after identifying attempts to access a very small minority of tax accounts," said Simon Grunwell, HMRCs Fraud Investigation Service operations lead.

The HMRC said it sent notification letters to all 100,000 taxpayers whose accounts were impacted by the scam between June 4th and June 25th.